Enterprise Identity

In a large organisation, identity is centralised infrastructure. Your application does not own accounts; it trusts an identity provider and enforces what that provider says.

Single sign-on means one authentication serves many applications. The application (the service provider) redirects to the identity provider, the user authenticates there, and comes back with a signed assertion of who they are. Your app never handles the password, which is the security win — and it means account lifecycle is centrally controlled, which is the operational win.

SAML is the long-standing enterprise standard: XML assertions, signed, usually delivered by browser POST. It is verbose and awkward compared to modern alternatives, and it is what large organisations already run, so it remains a hard requirement in enterprise sales. OIDC does the same job with JSON and JWTs and is the better choice where you can choose.

LDAP and Active Directory are directory services — the authoritative store of users, groups, and attributes. They answer "who exists and what groups are they in", which is usually the input to your authorisation.

SCIM automates provisioning: when HR creates an employee, accounts appear in connected applications, and when someone leaves, they are removed. Without it, provisioning is a ticket and deprovisioning is a ticket that nobody files.

Deprovisioning is the security-critical half and the one that fails. Leavers keep access because a manual step was missed, and orphaned accounts with valid credentials are a standard finding in every access audit. Automated deprovisioning is worth more than most preventive controls.

RBAC versus ABAC. Role-based access assigns permissions to roles and roles to people — simple, auditable, and prone to role explosion as exceptions accumulate. Attribute-based evaluates policies over attributes of the user, resource, and context: "a manager may approve expenses in their own department under £5,000". More expressive, harder to reason about, and much harder to answer "who can do X" from.